@chrbar: "Hello,
I've create a Domain for a small school.
The Domain is managed by one Windows Server 2003R2 SP2.
The workstations run Windows XP Pro SP3.
I have to delegate some rights to the teachers:
- rights to create/manage Students' accounts in AD,
- rights to add workstations in the Domain,
- Administrator's rights on the workstations (to be able to install 
softwares).
What is the best way to do that?
Does there some predefined groups in AD about that?
Thanks a lot for your help,
Chris"
    @florian: "Howdie!
<quote>
You could use the built-in group "Account Operators" for the user account 
management part - but I prefer creating custom groups and use the Delegation 
of Control wizard (right-click an OU!) to assign the specific permissions to 
the group. The wizard lets you specify what attributes the teachers can 
manage for the students.
Note that normal users can join ten workstations to the domain by default. 
The value is specified in the ms-DS-MachineAccountQuota attribute. You can 
set it to 0 and allow your teachers to join machines to the domain using the 
Delegation of Control wizard.
To get your teachers into the local administrators group, check "Restricted 
Groups", a Group Policy feature:
<url>
cheers,
Florian "
    @SubstituteThisWithMyFullNameSeparatedByDots: "see:
<url>
Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)
# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #
BLOG (WEB-BASED)> <url>
BLOG (RSS-FEEDS)> <url>
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
#################################################
#################################################
"chrbar" <email_address> wrote in message 
news:<email_address>
<quote>"
{'source': 'USENET', 'other_information': '{"reply_count": 2, "forum_name": "microsoft.public.windows.server.active_directory.20140621.mbox"}', 'file': 'data/output/usenet-microsoft.public.parquet'}